diff options
author | Andrey V. Elsukov <ae@FreeBSD.org> | 2019-03-18 11:44:53 +0000 |
---|---|---|
committer | Andrey V. Elsukov <ae@FreeBSD.org> | 2019-03-18 11:44:53 +0000 |
commit | 5c04f73e07b97ba421d072b7679e8ef477b8babc (patch) | |
tree | 0964d00626b0f6d2a7866bc2f031410dd7d69083 /sys/netpfil/ipfw/nat64 | |
parent | 002cae78daca2488aa423f13036a2c9dca5b134b (diff) | |
download | src-5c04f73e07b97ba421d072b7679e8ef477b8babc.tar.gz src-5c04f73e07b97ba421d072b7679e8ef477b8babc.zip |
Add NAT64 CLAT implementation as defined in RFC6877.
CLAT is customer-side translator that algorithmically translates 1:1
private IPv4 addresses to global IPv6 addresses, and vice versa.
It is implemented as part of ipfw_nat64 kernel module. When module
is loaded or compiled into the kernel, it registers "nat64clat" external
action. External action named instance can be created using `create`
command and then used in ipfw rules. The create command accepts two
IPv6 prefixes `plat_prefix` and `clat_prefix`. If plat_prefix is ommitted,
IPv6 NAT64 Well-Known prefix 64:ff9b::/96 will be used.
# ipfw nat64clat CLAT create clat_prefix SRC_PFX plat_prefix DST_PFX
# ipfw add nat64clat CLAT ip4 from IPv4_PFX to any out
# ipfw add nat64clat CLAT ip6 from DST_PFX to SRC_PFX in
Obtained from: Yandex LLC
Submitted by: Boris N. Lytochkin
MFC after: 1 month
Relnotes: yes
Sponsored by: Yandex LLC
Notes
Notes:
svn path=/head/; revision=345264
Diffstat (limited to 'sys/netpfil/ipfw/nat64')
-rw-r--r-- | sys/netpfil/ipfw/nat64/ip_fw_nat64.c | 7 | ||||
-rw-r--r-- | sys/netpfil/ipfw/nat64/ip_fw_nat64.h | 2 | ||||
-rw-r--r-- | sys/netpfil/ipfw/nat64/nat64clat.c | 255 | ||||
-rw-r--r-- | sys/netpfil/ipfw/nat64/nat64clat.h | 54 | ||||
-rw-r--r-- | sys/netpfil/ipfw/nat64/nat64clat_control.c | 614 |
5 files changed, 932 insertions, 0 deletions
diff --git a/sys/netpfil/ipfw/nat64/ip_fw_nat64.c b/sys/netpfil/ipfw/nat64/ip_fw_nat64.c index a0a975ac6b86..ea5ff597a7bf 100644 --- a/sys/netpfil/ipfw/nat64/ip_fw_nat64.c +++ b/sys/netpfil/ipfw/nat64/ip_fw_nat64.c @@ -86,9 +86,15 @@ vnet_ipfw_nat64_init(const void *arg __unused) error = nat64stl_init(ch, first); if (error != 0) return (error); + error = nat64clat_init(ch, first); + if (error != 0) { + nat64stl_uninit(ch, first); + return (error); + } error = nat64lsn_init(ch, first); if (error != 0) { nat64stl_uninit(ch, first); + nat64clat_uninit(ch, first); return (error); } return (0); @@ -103,6 +109,7 @@ vnet_ipfw_nat64_uninit(const void *arg __unused) ch = &V_layer3_chain; last = IS_DEFAULT_VNET(curvnet) ? 1: 0; nat64stl_uninit(ch, last); + nat64clat_uninit(ch, last); nat64lsn_uninit(ch, last); return (0); } diff --git a/sys/netpfil/ipfw/nat64/ip_fw_nat64.h b/sys/netpfil/ipfw/nat64/ip_fw_nat64.h index 11b60b873675..d6f38405cfba 100644 --- a/sys/netpfil/ipfw/nat64/ip_fw_nat64.h +++ b/sys/netpfil/ipfw/nat64/ip_fw_nat64.h @@ -54,5 +54,7 @@ int nat64stl_init(struct ip_fw_chain *ch, int first); void nat64stl_uninit(struct ip_fw_chain *ch, int last); int nat64lsn_init(struct ip_fw_chain *ch, int first); void nat64lsn_uninit(struct ip_fw_chain *ch, int last); +int nat64clat_init(struct ip_fw_chain *ch, int first); +void nat64clat_uninit(struct ip_fw_chain *ch, int last); #endif /* _IP_FW_NAT64_H_ */ diff --git a/sys/netpfil/ipfw/nat64/nat64clat.c b/sys/netpfil/ipfw/nat64/nat64clat.c new file mode 100644 index 000000000000..fcc922726d02 --- /dev/null +++ b/sys/netpfil/ipfw/nat64/nat64clat.c @@ -0,0 +1,255 @@ +/*- + * SPDX-License-Identifier: BSD-2-Clause-FreeBSD + * + * Copyright (c) 2019 Yandex LLC + * Copyright (c) 2019 Andrey V. Elsukov <ae@FreeBSD.org> + * Copyright (c) 2019 Boris N. Lytochkin <lytboris@gmail.com> + * + * Redistribution and use in source and binary forms, with or without + * modification, are permitted provided that the following conditions + * are met: + * + * 1. Redistributions of source code must retain the above copyright + * notice, this list of conditions and the following disclaimer. + * 2. Redistributions in binary form must reproduce the above copyright + * notice, this list of conditions and the following disclaimer in the + * documentation and/or other materials provided with the distribution. + * + * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR + * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES + * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. + * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, + * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT + * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, + * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY + * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT + * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF + * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. + */ + +#include <sys/cdefs.h> +__FBSDID("$FreeBSD$"); + +#include <sys/param.h> +#include <sys/systm.h> +#include <sys/counter.h> +#include <sys/kernel.h> +#include <sys/lock.h> +#include <sys/mbuf.h> +#include <sys/module.h> +#include <sys/rmlock.h> +#include <sys/rwlock.h> +#include <sys/socket.h> +#include <sys/sysctl.h> + +#include <net/if.h> +#include <net/if_var.h> +#include <net/if_pflog.h> +#include <net/pfil.h> + +#include <netinet/in.h> +#include <netinet/ip.h> +#include <netinet/ip_icmp.h> +#include <netinet/ip_var.h> +#include <netinet/ip_fw.h> +#include <netinet/ip6.h> +#include <netinet/icmp6.h> +#include <netinet6/ip_fw_nat64.h> + +#include <netpfil/ipfw/ip_fw_private.h> +#include <netpfil/pf/pf.h> + +#include "nat64clat.h" + +#define NAT64_LOOKUP(chain, cmd) \ + (struct nat64clat_cfg *)SRV_OBJECT((chain), (cmd)->arg1) + +static void +nat64clat_log(struct pfloghdr *plog, struct mbuf *m, sa_family_t family, + uint32_t kidx) +{ + static uint32_t pktid = 0; + + memset(plog, 0, sizeof(*plog)); + plog->length = PFLOG_REAL_HDRLEN; + plog->af = family; + plog->action = PF_NAT; + plog->dir = PF_IN; + plog->rulenr = htonl(kidx); + pktid++; + plog->subrulenr = htonl(pktid); + plog->ruleset[0] = '\0'; + strlcpy(plog->ifname, "NAT64CLAT", sizeof(plog->ifname)); + ipfw_bpf_mtap2(plog, PFLOG_HDRLEN, m); +} + +static int +nat64clat_handle_ip4(struct ip_fw_chain *chain, struct nat64clat_cfg *cfg, + struct mbuf *m) +{ + struct pfloghdr loghdr, *logdata; + struct in6_addr saddr, daddr; + struct ip *ip; + + ip = mtod(m, struct ip*); + /* source address for CLAT may be private with no harm */ + if (nat64_check_ip4(ip->ip_src.s_addr) != 0 || + nat64_check_ip4(ip->ip_dst.s_addr) != 0 || + nat64_check_private_ip4(&cfg->base, ip->ip_dst.s_addr) != 0) + return (NAT64SKIP); + + memcpy(&saddr, &cfg->base.clat_prefix, sizeof(saddr)); + nat64_embed_ip4(&saddr, cfg->base.clat_plen, ip->ip_src.s_addr); + memcpy(&daddr, &cfg->base.plat_prefix, sizeof(daddr)); + nat64_embed_ip4(&daddr, cfg->base.plat_plen, ip->ip_dst.s_addr); + if (cfg->base.flags & NAT64_LOG) { + logdata = &loghdr; + nat64clat_log(logdata, m, AF_INET, cfg->no.kidx); + } else + logdata = NULL; + return (nat64_do_handle_ip4(m, &saddr, &daddr, 0, &cfg->base, + logdata)); +} + +static int +nat64clat_handle_ip6(struct ip_fw_chain *chain, struct nat64clat_cfg *cfg, + struct mbuf *m) +{ + struct pfloghdr loghdr, *logdata; + struct ip6_hdr *ip6; + uint32_t aaddr; + + /* + * NOTE: we expect ipfw_chk() did m_pullup() up to upper level + * protocol's headers. Also we skip some checks, that ip6_input(), + * ip6_forward(), ip6_fastfwd() and ipfw_chk() already did. + */ + ip6 = mtod(m, struct ip6_hdr *); + /* Check ip6_dst matches configured prefix */ + if (memcmp(&ip6->ip6_dst, &cfg->base.clat_prefix, + cfg->base.clat_plen / 8) != 0) + return (NAT64SKIP); + /* Check ip6_src matches configured prefix */ + if (memcmp(&ip6->ip6_src, &cfg->base.plat_prefix, + cfg->base.plat_plen / 8) != 0) + return (NAT64SKIP); + + if (cfg->base.flags & NAT64_LOG) { + logdata = &loghdr; + nat64clat_log(logdata, m, AF_INET6, cfg->no.kidx); + } else + logdata = NULL; + + aaddr = nat64_extract_ip4(&ip6->ip6_src, cfg->base.plat_plen); + return (nat64_do_handle_ip6(m, aaddr, 0, &cfg->base, logdata)); +} + +static int +nat64clat_handle_icmp6(struct ip_fw_chain *chain, struct nat64clat_cfg *cfg, + struct mbuf *m) +{ + struct pfloghdr loghdr, *logdata; + struct nat64_counters *stats; + struct ip6_hdr *ip6i; + struct icmp6_hdr *icmp6; + uint32_t daddr; + int hlen, proto; + + hlen = 0; + stats = &cfg->base.stats; + proto = nat64_getlasthdr(m, &hlen); + if (proto != IPPROTO_ICMPV6) { + NAT64STAT_INC(stats, dropped); + return (NAT64MFREE); + } + icmp6 = mtodo(m, hlen); + switch (icmp6->icmp6_type) { + case ICMP6_DST_UNREACH: + case ICMP6_PACKET_TOO_BIG: + case ICMP6_TIME_EXCEED_TRANSIT: + case ICMP6_PARAM_PROB: + break; + default: + NAT64STAT_INC(stats, dropped); + return (NAT64MFREE); + } + hlen += sizeof(struct icmp6_hdr); + if (m->m_pkthdr.len < hlen + sizeof(struct ip6_hdr) + ICMP_MINLEN) { + NAT64STAT_INC(stats, dropped); + return (NAT64MFREE); + } + if (m->m_len < hlen + sizeof(struct ip6_hdr) + ICMP_MINLEN) + m = m_pullup(m, hlen + sizeof(struct ip6_hdr) + ICMP_MINLEN); + if (m == NULL) { + NAT64STAT_INC(stats, nomem); + return (NAT64RETURN); + } + /* + * Use destination address from inner IPv6 header to determine + * IPv4 mapped address. + */ + ip6i = mtodo(m, hlen); + daddr = nat64_extract_ip4(&ip6i->ip6_dst, cfg->base.clat_plen); + if (daddr == 0) { + NAT64STAT_INC(stats, dropped); + return (NAT64MFREE); + } + if (cfg->base.flags & NAT64_LOG) { + logdata = &loghdr; + nat64clat_log(logdata, m, AF_INET6, cfg->no.kidx); + } else + logdata = NULL; + return (nat64_handle_icmp6(m, 0, daddr, 0, &cfg->base, logdata)); +} + +int +ipfw_nat64clat(struct ip_fw_chain *chain, struct ip_fw_args *args, + ipfw_insn *cmd, int *done) +{ + ipfw_insn *icmd; + struct nat64clat_cfg *cfg; + int ret; + + IPFW_RLOCK_ASSERT(chain); + + *done = 0; /* try next rule if not matched */ + icmd = cmd + 1; + if (cmd->opcode != O_EXTERNAL_ACTION || + cmd->arg1 != V_nat64clat_eid || + icmd->opcode != O_EXTERNAL_INSTANCE || + (cfg = NAT64_LOOKUP(chain, icmd)) == NULL) + return (0); + + switch (args->f_id.addr_type) { + case 4: + ret = nat64clat_handle_ip4(chain, cfg, args->m); + break; + case 6: + ret = nat64clat_handle_ip6(chain, cfg, args->m); + break; + default: + return (0); + } + + if (ret == NAT64SKIP) { + /* + * In case when packet is ICMPv6 message from an intermediate + * router, the source address of message will not match the + * addresses from configured prefixes. + */ + if (args->f_id.proto != IPPROTO_ICMPV6) + return (0); + + ret = nat64clat_handle_icmp6(chain, cfg, args->m); + } + + if (ret == NAT64SKIP) + return (0); + + *done = 1; /* terminate the search */ + if (ret == NAT64MFREE) + m_freem(args->m); + + args->m = NULL; + return (IP_FW_NAT64); +} diff --git a/sys/netpfil/ipfw/nat64/nat64clat.h b/sys/netpfil/ipfw/nat64/nat64clat.h new file mode 100644 index 000000000000..70ca5ce5beb6 --- /dev/null +++ b/sys/netpfil/ipfw/nat64/nat64clat.h @@ -0,0 +1,54 @@ +/*- + * SPDX-License-Identifier: BSD-2-Clause-FreeBSD + * + * Copyright (c) 2019 Yandex LLC + * Copyright (c) 2019 Andrey V. Elsukov <ae@FreeBSD.org> + * Copyright (c) 2019 Boris N. Lytochkin <lytboris@gmail.com> + * + * Redistribution and use in source and binary forms, with or without + * modification, are permitted provided that the following conditions + * are met: + * + * 1. Redistributions of source code must retain the above copyright + * notice, this list of conditions and the following disclaimer. + * 2. Redistributions in binary form must reproduce the above copyright + * notice, this list of conditions and the following disclaimer in the + * documentation and/or other materials provided with the distribution. + * + * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR + * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES + * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. + * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, + * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT + * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, + * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY + * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT + * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF + * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. + * + * $FreeBSD$ + */ + +#ifndef _IP_FW_NAT64CLAT_H_ +#define _IP_FW_NAT64CLAT_H_ + +#include "ip_fw_nat64.h" +#include "nat64_translate.h" + +struct nat64clat_cfg { + struct named_object no; + + struct nat64_config base; +#define NAT64CLAT_FLAGSMASK \ + (NAT64_LOG | NAT64_ALLOW_PRIVATE) /* flags to pass to userland */ + char name[64]; +}; + +VNET_DECLARE(uint16_t, nat64clat_eid); +#define V_nat64clat_eid VNET(nat64clat_eid) +#define IPFW_TLV_NAT64CLAT_NAME IPFW_TLV_EACTION_NAME(V_nat64clat_eid) + +int ipfw_nat64clat(struct ip_fw_chain *chain, struct ip_fw_args *args, + ipfw_insn *cmd, int *done); + +#endif diff --git a/sys/netpfil/ipfw/nat64/nat64clat_control.c b/sys/netpfil/ipfw/nat64/nat64clat_control.c new file mode 100644 index 000000000000..2f6ac812bdd4 --- /dev/null +++ b/sys/netpfil/ipfw/nat64/nat64clat_control.c @@ -0,0 +1,614 @@ +/*- + * SPDX-License-Identifier: BSD-2-Clause-FreeBSD + * + * Copyright (c) 2019 Yandex LLC + * Copyright (c) 2019 Andrey V. Elsukov <ae@FreeBSD.org> + * Copyright (c) 2019 Boris N. Lytochkin <lytboris@gmail.com> + * + * Redistribution and use in source and binary forms, with or without + * modification, are permitted provided that the following conditions + * are met: + * + * 1. Redistributions of source code must retain the above copyright + * notice, this list of conditions and the following disclaimer. + * 2. Redistributions in binary form must reproduce the above copyright + * notice, this list of conditions and the following disclaimer in the + * documentation and/or other materials provided with the distribution. + * + * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR + * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES + * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. + * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, + * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT + * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, + * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY + * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT + * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF + * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. + */ + +#include <sys/cdefs.h> +__FBSDID("$FreeBSD$"); + +#include <sys/param.h> +#include <sys/systm.h> +#include <sys/counter.h> +#include <sys/errno.h> +#include <sys/kernel.h> +#include <sys/lock.h> +#include <sys/malloc.h> +#include <sys/mbuf.h> +#include <sys/module.h> +#include <sys/rmlock.h> +#include <sys/rwlock.h> +#include <sys/socket.h> +#include <sys/sockopt.h> +#include <sys/syslog.h> +#include <sys/sysctl.h> + +#include <net/if.h> +#include <net/if_var.h> +#include <net/route.h> +#include <net/vnet.h> + +#include <netinet/in.h> +#include <netinet/ip_var.h> +#include <netinet/ip_fw.h> +#include <netinet6/in6_var.h> +#include <netinet6/ip6_var.h> +#include <netinet6/ip_fw_nat64.h> + +#include <netpfil/ipfw/ip_fw_private.h> + +#include "nat64clat.h" + +VNET_DEFINE(uint16_t, nat64clat_eid) = 0; + +static struct nat64clat_cfg *nat64clat_alloc_config(const char *name, + uint8_t set); +static void nat64clat_free_config(struct nat64clat_cfg *cfg); +static struct nat64clat_cfg *nat64clat_find(struct namedobj_instance *ni, + const char *name, uint8_t set); + +static struct nat64clat_cfg * +nat64clat_alloc_config(const char *name, uint8_t set) +{ + struct nat64clat_cfg *cfg; + + cfg = malloc(sizeof(struct nat64clat_cfg), M_IPFW, M_WAITOK | M_ZERO); + COUNTER_ARRAY_ALLOC(cfg->base.stats.cnt, NAT64STATS, M_WAITOK); + cfg->no.name = cfg->name; + cfg->no.etlv = IPFW_TLV_NAT64CLAT_NAME; + cfg->no.set = set; + strlcpy(cfg->name, name, sizeof(cfg->name)); + return (cfg); +} + +static void +nat64clat_free_config(struct nat64clat_cfg *cfg) +{ + + COUNTER_ARRAY_FREE(cfg->base.stats.cnt, NAT64STATS); + free(cfg, M_IPFW); +} + +static void +nat64clat_export_config(struct ip_fw_chain *ch, struct nat64clat_cfg *cfg, + ipfw_nat64clat_cfg *uc) +{ + uc->plat_prefix = cfg->base.plat_prefix; + uc->plat_plen = cfg->base.plat_plen; + uc->clat_prefix = cfg->base.clat_prefix; + uc->clat_plen = cfg->base.clat_plen; + uc->flags = cfg->base.flags & NAT64CLAT_FLAGSMASK; + uc->set = cfg->no.set; + strlcpy(uc->name, cfg->no.name, sizeof(uc->name)); +} + +struct nat64clat_dump_arg { + struct ip_fw_chain *ch; + struct sockopt_data *sd; +}; + +static int +export_config_cb(struct namedobj_instance *ni, struct named_object *no, + void *arg) +{ + struct nat64clat_dump_arg *da = (struct nat64clat_dump_arg *)arg; + ipfw_nat64clat_cfg *uc; + + uc = (ipfw_nat64clat_cfg *)ipfw_get_sopt_space(da->sd, sizeof(*uc)); + nat64clat_export_config(da->ch, (struct nat64clat_cfg *)no, uc); + return (0); +} + +static struct nat64clat_cfg * +nat64clat_find(struct namedobj_instance *ni, const char *name, uint8_t set) +{ + struct nat64clat_cfg *cfg; + + cfg = (struct nat64clat_cfg *)ipfw_objhash_lookup_name_type(ni, set, + IPFW_TLV_NAT64CLAT_NAME, name); + + return (cfg); +} + +/* + * Creates new consumer-side nat64 translator instance. + * Data layout (v0)(current): + * Request: [ ipfw_obj_lheader ipfw_nat64clat_cfg ] + * + * Returns 0 on success + */ +static int +nat64clat_create(struct ip_fw_chain *ch, ip_fw3_opheader *op3, + struct sockopt_data *sd) +{ + ipfw_obj_lheader *olh; + ipfw_nat64clat_cfg *uc; + struct namedobj_instance *ni; + struct nat64clat_cfg *cfg; + + if (sd->valsize != sizeof(*olh) + sizeof(*uc)) + return (EINVAL); + + olh = (ipfw_obj_lheader *)sd->kbuf; + uc = (ipfw_nat64clat_cfg *)(olh + 1); + + if (ipfw_check_object_name_generic(uc->name) != 0) + return (EINVAL); + + if (uc->set >= IPFW_MAX_SETS || + nat64_check_prefix6(&uc->plat_prefix, uc->plat_plen) != 0 || + nat64_check_prefix6(&uc->clat_prefix, uc->clat_plen) != 0) + return (EINVAL); + + ni = CHAIN_TO_SRV(ch); + + IPFW_UH_RLOCK(ch); + if (nat64clat_find(ni, uc->name, uc->set) != NULL) { + IPFW_UH_RUNLOCK(ch); + return (EEXIST); + } + IPFW_UH_RUNLOCK(ch); + + cfg = nat64clat_alloc_config(uc->name, uc->set); + cfg->base.plat_prefix = uc->plat_prefix; + cfg->base.plat_plen = uc->plat_plen; + cfg->base.clat_prefix = uc->clat_prefix; + cfg->base.clat_plen = uc->clat_plen; + cfg->base.flags = (uc->flags & NAT64CLAT_FLAGSMASK) | + NAT64_CLATPFX | NAT64_PLATPFX; + if (IN6_IS_ADDR_WKPFX(&cfg->base.plat_prefix)) + cfg->base.flags |= NAT64_WKPFX; + + IPFW_UH_WLOCK(ch); + + if (nat64clat_find(ni, uc->name, uc->set) != NULL) { + IPFW_UH_WUNLOCK(ch); + nat64clat_free_config(cfg); + return (EEXIST); + } + + if (ipfw_objhash_alloc_idx(ni, &cfg->no.kidx) != 0) { + IPFW_UH_WUNLOCK(ch); + nat64clat_free_config(cfg); + return (ENOSPC); + } + ipfw_objhash_add(CHAIN_TO_SRV(ch), &cfg->no); + /* Okay, let's link data */ + SRV_OBJECT(ch, cfg->no.kidx) = cfg; + IPFW_UH_WUNLOCK(ch); + + return (0); +} + +/* + * Change existing nat64clat instance configuration. + * Data layout (v0)(current): + * Request: [ ipfw_obj_header ipfw_nat64clat_cfg ] + * Reply: [ ipfw_obj_header ipfw_nat64clat_cfg ] + * + * Returns 0 on success + */ +static int +nat64clat_config(struct ip_fw_chain *ch, ip_fw3_opheader *op, + struct sockopt_data *sd) +{ + ipfw_obj_header *oh; + ipfw_nat64clat_cfg *uc; + struct nat64clat_cfg *cfg; + struct namedobj_instance *ni; + uint32_t flags; + + if (sd->valsize != sizeof(*oh) + sizeof(*uc)) + return (EINVAL); + + oh = (ipfw_obj_header *)ipfw_get_sopt_space(sd, + sizeof(*oh) + sizeof(*uc)); + uc = (ipfw_nat64clat_cfg *)(oh + 1); + + if (ipfw_check_object_name_generic(oh->ntlv.name) != 0 || + oh->ntlv.set >= IPFW_MAX_SETS) + return (EINVAL); + + ni = CHAIN_TO_SRV(ch); + if (sd->sopt->sopt_dir == SOPT_GET) { + IPFW_UH_RLOCK(ch); + cfg = nat64clat_find(ni, oh->ntlv.name, oh->ntlv.set); + if (cfg == NULL) { + IPFW_UH_RUNLOCK(ch); + return (ENOENT); + } + nat64clat_export_config(ch, cfg, uc); + IPFW_UH_RUNLOCK(ch); + return (0); + } + + IPFW_UH_WLOCK(ch); + cfg = nat64clat_find(ni, oh->ntlv.name, oh->ntlv.set); + if (cfg == NULL) { + IPFW_UH_WUNLOCK(ch); + return (ENOENT); + } + + /* + * For now allow to change only following values: + * plat_prefix, plat_plen, clat_prefix, clat_plen, flags. + */ + flags = 0; + if (uc->plat_plen != cfg->base.plat_plen || + !IN6_ARE_ADDR_EQUAL(&uc->plat_prefix, &cfg->base.plat_prefix)) { + if (nat64_check_prefix6(&uc->plat_prefix, uc->plat_plen) != 0) { + IPFW_UH_WUNLOCK(ch); + return (EINVAL); + } + flags |= NAT64_PLATPFX; + } + + if (uc->clat_plen != cfg->base.clat_plen || + !IN6_ARE_ADDR_EQUAL(&uc->clat_prefix, &cfg->base.clat_prefix)) { + if (nat64_check_prefix6(&uc->clat_prefix, uc->clat_plen) != 0) { + IPFW_UH_WUNLOCK(ch); + return (EINVAL); + } + flags |= NAT64_CLATPFX; + } + + if (flags != 0) { + IPFW_WLOCK(ch); + if (flags & NAT64_PLATPFX) { + cfg->base.plat_prefix = uc->plat_prefix; + cfg->base.plat_plen = uc->plat_plen; + } + if (flags & NAT64_CLATPFX) { + cfg->base.clat_prefix = uc->clat_prefix; + cfg->base.clat_plen = uc->clat_plen; + } + IPFW_WUNLOCK(ch); + } + + cfg->base.flags &= ~NAT64CLAT_FLAGSMASK; + cfg->base.flags |= uc->flags & NAT64CLAT_FLAGSMASK; + + IPFW_UH_WUNLOCK(ch); + return (0); +} + +static void +nat64clat_detach_config(struct ip_fw_chain *ch, struct nat64clat_cfg *cfg) +{ + + IPFW_UH_WLOCK_ASSERT(ch); + + ipfw_objhash_del(CHAIN_TO_SRV(ch), &cfg->no); + ipfw_objhash_free_idx(CHAIN_TO_SRV(ch), cfg->no.kidx); +} + +/* + * Destroys nat64 instance. + * Data layout (v0)(current): + * Request: [ ipfw_obj_header ] + * + * Returns 0 on success + */ +static int +nat64clat_destroy(struct ip_fw_chain *ch, ip_fw3_opheader *op3, + struct sockopt_data *sd) +{ + ipfw_obj_header *oh; + struct nat64clat_cfg *cfg; + + if (sd->valsize != sizeof(*oh)) + return (EINVAL); + + oh = (ipfw_obj_header *)sd->kbuf; + if (ipfw_check_object_name_generic(oh->ntlv.name) != 0) + return (EINVAL); + + IPFW_UH_WLOCK(ch); + cfg = nat64clat_find(CHAIN_TO_SRV(ch), oh->ntlv.name, oh->ntlv.set); + if (cfg == NULL) { + IPFW_UH_WUNLOCK(ch); + return (ENOENT); + } + if (cfg->no.refcnt > 0) { + IPFW_UH_WUNLOCK(ch); + return (EBUSY); + } + + ipfw_reset_eaction_instance(ch, V_nat64clat_eid, cfg->no.kidx); + SRV_OBJECT(ch, cfg->no.kidx) = NULL; + nat64clat_detach_config(ch, cfg); + IPFW_UH_WUNLOCK(ch); + + nat64clat_free_config(cfg); + return (0); +} + +/* + * Lists all nat64clat instances currently available in kernel. + * Data layout (v0)(current): + * Request: [ ipfw_obj_lheader ] + * Reply: [ ipfw_obj_lheader ipfw_nat64clat_cfg x N ] + * + * Returns 0 on success + */ +static int +nat64clat_list(struct ip_fw_chain *ch, ip_fw3_opheader *op3, + struct sockopt_data *sd) +{ + ipfw_obj_lheader *olh; + struct nat64clat_dump_arg da; + + /* Check minimum header size */ + if (sd->valsize < sizeof(ipfw_obj_lheader)) + return (EINVAL); + + olh = (ipfw_obj_lheader *)ipfw_get_sopt_header(sd, sizeof(*olh)); + + IPFW_UH_RLOCK(ch); + olh->count = ipfw_objhash_count_type(CHAIN_TO_SRV(ch), + IPFW_TLV_NAT64CLAT_NAME); + olh->objsize = sizeof(ipfw_nat64clat_cfg); + olh->size = sizeof(*olh) + olh->count * olh->objsize; + + if (sd->valsize < olh->size) { + IPFW_UH_RUNLOCK(ch); + return (ENOMEM); + } + memset(&da, 0, sizeof(da)); + da.ch = ch; + da.sd = sd; + ipfw_objhash_foreach_type(CHAIN_TO_SRV(ch), export_config_cb, + &da, IPFW_TLV_NAT64CLAT_NAME); + IPFW_UH_RUNLOCK(ch); + + return (0); +} + +#define __COPY_STAT_FIELD(_cfg, _stats, _field) \ + (_stats)->_field = NAT64STAT_FETCH(&(_cfg)->base.stats, _field) +static void +export_stats(struct ip_fw_chain *ch, struct nat64clat_cfg *cfg, + struct ipfw_nat64clat_stats *stats) +{ + + __COPY_STAT_FIELD(cfg, stats, opcnt64); + __COPY_STAT_FIELD(cfg, stats, opcnt46); + __COPY_STAT_FIELD(cfg, stats, ofrags); + __COPY_STAT_FIELD(cfg, stats, ifrags); + __COPY_STAT_FIELD(cfg, stats, oerrors); + __COPY_STAT_FIELD(cfg, stats, noroute4); + __COPY_STAT_FIELD(cfg, stats, noroute6); + __COPY_STAT_FIELD(cfg, stats, noproto); + __COPY_STAT_FIELD(cfg, stats, nomem); + __COPY_STAT_FIELD(cfg, stats, dropped); +} + +/* + * Get nat64clat statistics. + * Data layout (v0)(current): + * Request: [ ipfw_obj_header ] + * Reply: [ ipfw_obj_header ipfw_obj_ctlv [ uint64_t x N ]] + * + * Returns 0 on success + */ +static int +nat64clat_stats(struct ip_fw_chain *ch, ip_fw3_opheader *op, + struct sockopt_data *sd) +{ + struct ipfw_nat64clat_stats stats; + struct nat64clat_cfg *cfg; + ipfw_obj_header *oh; + ipfw_obj_ctlv *ctlv; + size_t sz; + + sz = sizeof(ipfw_obj_header) + sizeof(ipfw_obj_ctlv) + sizeof(stats); + if (sd->valsize % sizeof(uint64_t)) + return (EINVAL); + if (sd->valsize < sz) + return (ENOMEM); + oh = (ipfw_obj_header *)ipfw_get_sopt_header(sd, sz); + if (oh == NULL) + return (EINVAL); + memset(&stats, 0, sizeof(stats)); + + IPFW_UH_RLOCK(ch); + cfg = nat64clat_find(CHAIN_TO_SRV(ch), oh->ntlv.name, oh->ntlv.set); + if (cfg == NULL) { + IPFW_UH_RUNLOCK(ch); + return (ENOENT); + } + export_stats(ch, cfg, &stats); + IPFW_UH_RUNLOCK(ch); + + ctlv = (ipfw_obj_ctlv *)(oh + 1); + memset(ctlv, 0, sizeof(*ctlv)); + ctlv->head.type = IPFW_TLV_COUNTERS; + ctlv->head.length = sz - sizeof(ipfw_obj_header); + ctlv->count = sizeof(stats) / sizeof(uint64_t); + ctlv->objsize = sizeof(uint64_t); + ctlv->version = IPFW_NAT64_VERSION; + memcpy(ctlv + 1, &stats, sizeof(stats)); + return (0); +} + +/* + * Reset nat64clat statistics. + * Data layout (v0)(current): + * Request: [ ipfw_obj_header ] + * + * Returns 0 on success + */ +static int +nat64clat_reset_stats(struct ip_fw_chain *ch, ip_fw3_opheader *op, + struct sockopt_data *sd) +{ + struct nat64clat_cfg *cfg; + ipfw_obj_header *oh; + + if (sd->valsize != sizeof(*oh)) + return (EINVAL); + oh = (ipfw_obj_header *)sd->kbuf; + if (ipfw_check_object_name_generic(oh->ntlv.name) != 0 || + oh->ntlv.set >= IPFW_MAX_SETS) + return (EINVAL); + + IPFW_UH_WLOCK(ch); + cfg = nat64clat_find(CHAIN_TO_SRV(ch), oh->ntlv.name, oh->ntlv.set); + if (cfg == NULL) { + IPFW_UH_WUNLOCK(ch); + return (ENOENT); + } + COUNTER_ARRAY_ZERO(cfg->base.stats.cnt, NAT64STATS); + IPFW_UH_WUNLOCK(ch); + return (0); +} + +static struct ipfw_sopt_handler scodes[] = { + + { IP_FW_NAT64CLAT_CREATE, 0, HDIR_SET, nat64clat_create }, + { IP_FW_NAT64CLAT_DESTROY,0, HDIR_SET, nat64clat_destroy }, + { IP_FW_NAT64CLAT_CONFIG, 0, HDIR_BOTH, nat64clat_config }, + { IP_FW_NAT64CLAT_LIST, 0, HDIR_GET, nat64clat_list }, + { IP_FW_NAT64CLAT_STATS, 0, HDIR_GET, nat64clat_stats }, + { IP_FW_NAT64CLAT_RESET_STATS,0, HDIR_SET, nat64clat_reset_stats }, +}; + +static int +nat64clat_classify(ipfw_insn *cmd, uint16_t *puidx, uint8_t *ptype) +{ + ipfw_insn *icmd; + + icmd = cmd - 1; + if (icmd->opcode != O_EXTERNAL_ACTION || + icmd->arg1 != V_nat64clat_eid) + return (1); + + *puidx = cmd->arg1; + *ptype = 0; + return (0); +} + +static void +nat64clat_update_arg1(ipfw_insn *cmd, uint16_t idx) +{ + + cmd->arg1 = idx; +} + +static int +nat64clat_findbyname(struct ip_fw_chain *ch, struct tid_info *ti, + struct named_object **pno) +{ + int err; + + err = ipfw_objhash_find_type(CHAIN_TO_SRV(ch), ti, + IPFW_TLV_NAT64CLAT_NAME, pno); + return (err); +} + +static struct named_object * +nat64clat_findbykidx(struct ip_fw_chain *ch, uint16_t idx) +{ + struct namedobj_instance *ni; + struct named_object *no; + + IPFW_UH_WLOCK_ASSERT(ch); + ni = CHAIN_TO_SRV(ch); + no = ipfw_objhash_lookup_kidx(ni, idx); + KASSERT(no != NULL, ("NAT with index %d not found", idx)); + + return (no); +} + +static int +nat64clat_manage_sets(struct ip_fw_chain *ch, uint16_t set, uint8_t new_set, + enum ipfw_sets_cmd cmd) +{ + + return (ipfw_obj_manage_sets(CHAIN_TO_SRV(ch), IPFW_TLV_NAT64CLAT_NAME, + set, new_set, cmd)); +} + +static struct opcode_obj_rewrite opcodes[] = { + { + .opcode = O_EXTERNAL_INSTANCE, + .etlv = IPFW_TLV_EACTION /* just show it isn't table */, + .classifier = nat64clat_classify, + .update = nat64clat_update_arg1, + .find_byname = nat64clat_findbyname, + .find_bykidx = nat64clat_findbykidx, + .manage_sets = nat64clat_manage_sets, + }, +}; + +static int +destroy_config_cb(struct namedobj_instance *ni, struct named_object *no, + void *arg) +{ + struct nat64clat_cfg *cfg; + struct ip_fw_chain *ch; + + ch = (struct ip_fw_chain *)arg; + cfg = (struct nat64clat_cfg *)SRV_OBJECT(ch, no->kidx); + SRV_OBJECT(ch, no->kidx) = NULL; + nat64clat_detach_config(ch, cfg); + nat64clat_free_config(cfg); + return (0); +} + +int +nat64clat_init(struct ip_fw_chain *ch, int first) +{ + + V_nat64clat_eid = ipfw_add_eaction(ch, ipfw_nat64clat, "nat64clat"); + if (V_nat64clat_eid == 0) + return (ENXIO); + IPFW_ADD_SOPT_HANDLER(first, scodes); + IPFW_ADD_OBJ_REWRITER(first, opcodes); + return (0); +} + +void +nat64clat_uninit(struct ip_fw_chain *ch, int last) +{ + + IPFW_DEL_OBJ_REWRITER(last, opcodes); + IPFW_DEL_SOPT_HANDLER(last, scodes); + ipfw_del_eaction(ch, V_nat64clat_eid); + /* + * Since we already have deregistered external action, + * our named objects become unaccessible via rules, because + * all rules were truncated by ipfw_del_eaction(). + * So, we can unlink and destroy our named objects without holding + * IPFW_WLOCK(). + */ + IPFW_UH_WLOCK(ch); + ipfw_objhash_foreach_type(CHAIN_TO_SRV(ch), destroy_config_cb, ch, + IPFW_TLV_NAT64CLAT_NAME); + V_nat64clat_eid = 0; + IPFW_UH_WUNLOCK(ch); +} + |